VYPR
← All advisories
Low severity3.3NVD Advisory· Published Nov 6, 2019· Updated Jun 17, 2026

CVE-2019-5642

CVE-2019-5642

Description

Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable permissions. This can allow other users of the same system where Metasploit Pro is installed to intercept otherwise private communications to the Metasploit Pro web interface.

Affected products

7
  • Rapid7/Metasploit7 versions
    cpe:2.3:a:rapid7:metasploit:*:*:*:*:pro:*:*:*+ 6 more
    • cpe:2.3:a:rapid7:metasploit:*:*:*:*:pro:*:*:*range: <4.16.0
    • cpe:2.3:a:rapid7:metasploit:4.16.0:-:*:*:pro:*:*:*
    • cpe:2.3:a:rapid7:metasploit:4.16.0:20190722:*:*:pro:*:*:*
    • cpe:2.3:a:rapid7:metasploit:4.16.0:20190805:*:*:pro:*:*:*
    • cpe:2.3:a:rapid7:metasploit:4.16.0:2019081901:*:*:pro:*:*:*
    • (no CPE)range: <=4.16.0-2019081901
    • (no CPE)range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.